Defused and KEVIntel have observed active exploitation attempts against three Fortinet FortiSandbox vulnerabilities: CVE-2026-39808 (OS command injection), CVE-2026-39813 (authentication bypass), and CVE-2026-25089 (remote command execution). CVE-2026-39808 and CVE-2026-39813 were patched in April 2026, while CVE-2026-25089 was patched in June 2026. Exploits for these vulnerabilities have been detected in the wild, with some created using AI techniques. Separately, SOCRadar detected a campaign compromising over 30,000 Fortinet firewalls and VPN gateways by scanning for devices and using a curated list of known passwords to gain access. The attackers collect credentials from compromised devices to facilitate further intrusions. The compromised systems span more than 190 countries, including India and the United States, and include sensitive sectors such as defense. The threat actor's infrastructure was partially exposed, allowing researchers to analyze their operations. Fortinet has released patches addressing these vulnerabilities.

Successful exploitation of CVE-2026-39808 and CVE-2026-25089 allows remote unauthenticated attackers to execute arbitrary commands on vulnerable FortiSandbox appliances, potentially leading to full system compromise. CVE-2026-39813 enables attackers to bypass authentication controls, facilitating unauthorized access. The large-scale compromise of Fortinet firewalls and VPN gateways (FortiBleed campaign) exposes corporate and government networks to unauthorized access, credential theft, and persistent monitoring. The collection of credentials from compromised devices enables attackers to expand their access footprint, increasing the risk of data breaches and espionage, especially given the involvement of defense industry VPN endpoints.

Fortinet has issued official patches for CVE-2026-39808 and CVE-2026-39813 in April 2026 and for CVE-2026-25089 in June 2026. Organizations using FortiSandbox appliances should apply these patches immediately to mitigate the vulnerabilities. For Fortinet firewalls and VPN gateways, it is critical to change default or known weak passwords, implement strong password policies, and monitor for unauthorized access. Since the threat actor uses credential stuffing techniques, organizations should consider multi-factor authentication where possible and review access logs for suspicious activity. Patch status is confirmed as official fixes are available. No vendor advisory indicates that no action is required.